{"schema":"sanctity-signal/0.2","record_type":"signal","id":"deepmind-rsa1024-fan-factories-e080","domain":"science","drop_id":"signal-e080","occurred_at":"2026-11-06","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Google DeepMind","action_type":"publication of a working paper and a second cryptanalytic result on legacy 1024-bit RSA, with the analysis and the Lean 4 formalisation produced by a 2 agent AI harness","observed":"We read the primary ourselves: \"Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS,\" a working paper dated November 5, 2026, on Google DeepMind's own media server at storage.googleapis.com/deepmind-media. It carries 12 authors: Krishnamurthy (Dj) Dvijotham, Nadia Heninger, Owen Jones, Pushmeet Kohli, Borislav Kozlovskii, Shrinu Kushagra, Chirag Pabbaraju, Robert Stanforth, Abhradeep Thakurta, Emmanuel Thome, Nenad Tomasev and Adam Zsolt Wagner, all at Google DeepMind, with Heninger also at the University of California San Diego and Inria, Thome also at Inria, and Pabbaraju also at Stanford University. The method gives each integer its own family of number fields, a fan, sharing one precomputed rational side, and derives the best per-integer cost for every precomputation budget. With a precomputation budget of one general number field sieve run, each further integer costs about L[1.7929] against L[1.9019] for the previous best batch method, MNFS. At leading order for 1024-bit integers that is about 1 in 58 of a GNFS run, roughly 30 times cheaper than MNFS. Those figures belong to factory mode with precomputation, not batch mode: there the per-integer exponent improves by at most 0.018, near mu about 0.0213, a factor of at most about 1.75 at 1024 bits. The paper states the results hold under standard NFS heuristics, that the algebraic identities and exact feasibility witnesses are machine-checked in Lean 4, and that the analysis and the formalisation were developed with a 2 agent AI harness, one model generating proofs and a second verifying them. It says the results do not threaten deployed cryptosystems based on 2048-bit and larger RSA, that the fan factory needs precomputation about as costly as factoring one integer of the target size, and that a single integer alone gains nothing. The second result, on signature padding, we could not read at a primary: eprint.iacr.org refused us. Reported for that half: a sandboxed run against an already-solved 1024-bit benchmark key used 3.5 times less CPU time, and where the attacker controls only a 32-byte digest the estimated gain over the best prior method is about 1,600 times.","corrections":[],"evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"Google DeepMind working paper: Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS, Nov 5, 2026","url":"https://storage.googleapis.com/deepmind-media/papers/Fan_Factories_Multiple_Number_Fields_in_Factorization_Factories_and_Batch_NFS.pdf"},{"role":"corrob","label":"Pushmeet Kohli, DeepMind vice president of science, on X: the Science team is sharing 2 cryptographic advances","url":"https://x.com/pushmeet/status/2118753824194408683"},{"role":"corrob","label":"Data Studios: Google DeepMind AI agents find two weaknesses in legacy 1024-bit RSA, Nov 6, 2026","url":"https://www.datastudios.org/post/google-deepmind-ai-agents-two-weaknesses-legacy-1024-bit-rsa"},{"role":"corrob","label":"OfficeChai: Google DeepMind says it has used AI agents to break legacy RSA-1024, Nov 6, 2026, 18:25","url":"https://officechai.com/ai/google-deepmind-says-it-has-used-ai-agents-to-break-legacy-rsa-1024-encryption-faster-than-anyone-thought-possible/"},{"role":"corrob","label":"Crypto Briefing: Google DeepMind's AI agents expose two weaknesses in legacy 1024-bit RSA, Nov 6, 2026","url":"https://cryptobriefing.com/google-deepmind-ai-rsa-1024-bit-weaknesses/"}]},"strength":{"cost":"Medium","commitment":"High","reversibility":"Hard","persistence":"Structural","rationale":"Cost is medium. 12 authors, external academic collaborators at 3 institutions, weeks of agent compute and a Lean formalisation are real spending, but no hardware and no money changed hands. Commitment is high: a named working paper on the company's own server, with 12 signatures and a machine-checked proof, cannot be quietly withdrawn. Reversibility is hard for the same reason, and because the complexity result is either right or wrong rather than negotiable. Persistence is structural: a better asymptotic bound does not expire, and the harness that produced it can be pointed at the next problem tomorrow."},"shift":{"prior":"AI helps cryptographers with code and search, not with new complexity results.","action":"We read the primary ourselves: \"Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS,\" a working paper dated November 5, 2026, on Google DeepMind's own media server at storage.googleapis.com/deepmind-media. It carries 12 authors: Krishnamurthy (Dj) Dvijotham, Nadia Heninger, Owen Jones, Pushmeet Kohli, Borislav Kozlovskii, Shrinu Kushagra, Chirag Pabbaraju, Robert Stanforth, Abhradeep Thakurta, Emmanuel Thome, Nenad Tomasev and Adam Zsolt Wagner, all at Google DeepMind, with Heninger also at the University of California San Diego and Inria, Thome also at Inria, and Pabbaraju also at Stanford University. The method gives each integer its own family of number fields, a fan, sharing one precomputed rational side, and derives the best per-integer cost for every precomputation budget. With a precomputation budget of one general number field sieve run, each further integer costs about L[1.7929] against L[1.9019] for the previous best batch method, MNFS. At leading order for 1024-bit integers that is about 1 in 58 of a GNFS run, roughly 30 times cheaper than MNFS. Those figures belong to factory mode with precomputation, not batch mode: there the per-integer exponent improves by at most 0.018, near mu about 0.0213, a factor of at most about 1.75 at 1024 bits. The paper states the results hold under standard NFS heuristics, that the algebraic identities and exact feasibility witnesses are machine-checked in Lean 4, and that the analysis and the formalisation were developed with a 2 agent AI harness, one model generating proofs and a second verifying them. It says the results do not threaten deployed cryptosystems based on 2048-bit and larger RSA, that the fan factory needs precomputation about as costly as factoring one integer of the target size, and that a single integer alone gains nothing. The second result, on signature padding, we could not read at a primary: eprint.iacr.org refused us. Reported for that half: a sandboxed run against an already-solved 1024-bit benchmark key used 3.5 times less CPU time, and where the attacker controls only a 32-byte digest the estimated gain over the best prior method is about 1,600 times.","update":"An AI harness produced a complexity gain on the best known batch method."},"inference":{"established":["Per-integer batch cost falls to L[1.7929] from L[1.9019], the previous best.","At 1024 bits, about 1 in 58 of one run: 30 times cheaper.","Algebraic identities are machine-checked in Lean 4, produced by a 2 agent harness."],"unknown":["That 2048-bit RSA is weakened. The paper says it is not.","That any key was broken. No implementation of the batch result exists.","That AI worked alone. Named human cryptanalysis experts co-authored it."]},"narrative":{"hook":"Google DeepMind published a machine-checked result cutting the cost of factoring 1024-bit keys in bulk.","plain":"The paper is dated November 5 and DeepMind announced it on November 6. Its authors say AI agents produced the analysis and the Lean 4 proofs. Caveat: it says 2048-bit RSA is not threatened.","story":["The number that matters is not 1024. It is that a 2 agent harness, one model proving and one checking, beat the previous best batch factoring method and had the algebra verified in Lean 4. The same harness pointed at larger key sizes is the question this opens."],"trail":[{"d":"1993","t":"Don Coppersmith proposes the factorization factory: pay once to precompute, then factor many integers of the same size more cheaply. This paper generalises it by giving each integer its own family of number fields."},{"d":"SEP 4","t":"Anthropic publishes a computer-checked proof of Fermat's Last Theorem that its model wrote in 11 days. Edition 013, the first card on a laboratory offering machine-checked mathematics as evidence."},{"d":"NOV 4","t":"OpenAI's pipeline finds 948 root-access bugs in Linux for about $1.2 million, about $1,279 per bug. Edition 074. AI finding real flaws at scale, 2 days before this."},{"d":"NOV 5","t":"The working paper carries this date, with 12 authors and collaborators at the University of California San Diego, Inria and Stanford University."},{"d":"NOV 6","t":"DeepMind announces both results. Pushmeet Kohli, its vice president of science, posts that the team is sharing 2 cryptographic advances made in weeks with leading cryptanalysis experts."},{"d":"Reacts","r":true,"t":"Every operator still running 1024-bit keys in code signing, legacy certificates and embedded devices; the National Institute of Standards and Technology, which retired 1024-bit RSA years ago and now owns the post-quantum migration timetable; certificate authorities; OpenAI and Anthropic, which both publish cyber capability numbers; and the referees whose role a proof assistant just took."}],"glossary":[{"term":"RSA","def":"A public key encryption and signature scheme whose security rests on the difficulty of factoring one large number. The bit length is that number's size."},{"term":"Number field sieve","def":"The fastest known general method for factoring large numbers. One GNFS run is the unit of cost cryptographers compare against."},{"term":"Lean 4","def":"A proof assistant. A proof it accepts has had every step checked by a computer, which removes the chance of human error in the algebra."},{"term":"Batch factoring","def":"Factoring many numbers of the same size together, sharing work, so each extra number costs less than the first."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"AI now does novel mathematics","text":"A machine-checked complexity gain over the previous best method is a new result.","abstain":false},{"id":"b","label":"A narrow result on dead keys","text":"1024-bit RSA was retired years ago. Nothing deployed today is affected.","abstain":false},{"id":"c","label":"A deliberate warning shot","text":"DeepMind chose cryptanalysis, published in weeks, and said what is not yet affected.","abstain":false},{"id":"d","label":"Normal research, better tools","text":"Cryptographers have used computer search for decades. The harness is the new part.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second complexity or hardness result credited to an AI harness is published by a frontier laboratory and survives peer review or independent reproduction, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"A cryptographer publishes an error in the fan factory analysis or the Lean formalisation, or the signature-padding paper is withdrawn or materially revised, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"b","direction":"strengthens","observable_event":"No standards body, certificate authority or government issues guidance citing these results, and no 1024-bit deprecation deadline is brought forward, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"}]}